Merged PR 2315: Auth stabilistatiion and hardening

Related work items: #23020
2026-05-14 08:55:49 +00:00
parent d295a507ac
commit d0b2fd077a
41 changed files with 1462 additions and 418 deletions
@@ -0,0 +1,62 @@
+# Phase 1 Stabilisation Plan (Execution Start)
+
+Last updated: 2026-05-14
+
+## Goal
+
+Reduce operational risk without changing PEDW business behaviour.
+
+## Priority order
+
+1. **Auth/session reliability**
+2. **SSR/data-loading resilience**
+3. **Logging/observability hardening**
+4. **Low-risk performance improvements**
+
+## Slice plan
+
+### Slice P0.1 (started)
+
+- Centralize client-side signout/cookie cleanup into shared helper.
+- Replace duplicated logout logic in timeout and portal/header surfaces.
+
+Status: completed across timeout, header, service banner, myportal, furtherdetails, and auth error paths.
+
+### Slice P0.2 (started)
+
+- Harden NextAuth redirect/locale callback handling.
+- Add safer URL parsing fallback behaviour.
+
+Status: completed with callback-cookie parity support and redacted diagnostics.
+
+### Slice P1.1 (started)
+
+- Add defensive null and redirect handling in representation SSR loader path.
+
+Status: expanded to new appeal, myportal appeal, and representation loader guard hardening.
+
+### Slice P3.1 (started)
+
+- Add in-memory XML read cache for form XML to reduce repeated disk read/normalization cost.
+
+Status: completed.
+
+## Immediate slices status (updated)
+
+1. Add defensive wrappers for external dependency failures in new-appeal/myportal/representation SSR loaders (fallback redirects + safe defaults).
+    - Status: completed.
+2. Expand focused tests around loader negative paths (missing query/session/cookie/search result branches).
+    - Status: completed with dedicated phase22 suites for newappeal, myportal, and representation loaders.
+3. Add lightweight diagnostics for SSR loader dependency failures (redacted, non-sensitive).
+    - Status: completed.
+4. Reduce remaining low-value commented legacy blocks in active flow files where behaviour is already covered by tests.
+    - Status: completed for active myportal case-ticket page path.
+
+## Next recommended Phase 1 closure slices
+
+1. Add targeted loader-dependency-failure tests (thrown service errors -> safe redirect) for newappeal/myportal/representation loaders.
+    - Status: in progress (newappeal + myportal dependency-failure tests added; representation search-miss redirect coverage added).
+2. Perform a focused pass on remaining active flow files for stale commented code/debug remnants and remove where behaviour is covered.
+    - Status: in progress (myportal case-ticket path completed; further active-flow pass still open).
+3. Refresh current-platform-state/auth-session-reliability notes with latest implemented slices and residual risks.
+    - Status: not started.